[jeremyprime]

Summary

An IAM authentication token is a bearer credential. Sending it over a plaintext connection lets a network attacker capture and replay it. Core now rejects IAM auth when TLS is disabled, failing closed before any token is created or sent (valkey-io/valkey-glide#7397). This bumps the submodule to that fix and upgrades the IAM integration tests to run over TLS.

Issue link

Related: valkey-io/valkey-glide#7023

Changes

• Bump valkey-glide submodule to the merged core TLS-enforcement fix (b360e69b).
• IAM integration tests connect over the standalone TLS server and skip when no TLS server is available (including the cluster context, which has no TLS endpoint). The refresh-interval rejection tests also run over TLS, since that Core validation sits behind the new guard.
• README iam_config row now notes TLS is required.

Testing

• IAM integration tests pass over TLS (7/7).
• A-B validated: forcing the IAM client to plaintext fails with the guard error ("IAM authentication requires TLS").

Checklist

• This Pull Request is related to an issue.
• Commit message describe your changes
• Commits are signed off (git commit -s) per the DCO.
• Tests are added or updated.
• CHANGELOG.md and documentation files are updated.
• Linters have been run (bundle exec rubocop) and pass.
• Destination branch is correct - main.

[Aryex]

Since TLS + IAM validation sits at the core I assume that is tested already?

Other than that, just some cleanup for comments.

[jeremyprime]

Since TLS + IAM validation sits at the core I assume that is tested already?

Other than that, just some cleanup for comments.

Yes, the TLS guard is in the core and there are tests at that level to verify it works.